--- id: "CVE-2017-12617" kind: "vulnerability" aliases: ["CVE-2017-12617"] title: "Apache Tomcat: Apache Tomcat Remote Code Execution Vulnerability" severity: "critical" cvss: 8.1 epss: 0.99968 exploited: true status: "open" category: "runtime" products: [{"name": "Apache Tomcat", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Apache Tomcat 9", "fixed": ["9.0.1"], "affected": ">= 9.0.0.M1, <= 9.0.0", "ecosystem": "vendor"}, {"name": "Apache Tomcat 8.5", "fixed": ["8.5.23"], "affected": ">= 8.5.0, <= 8.5.22", "ecosystem": "vendor"}, {"name": "Apache Tomcat 8.0", "fixed": ["8.0.47"], "affected": ">= 8.0.0.RC1, <= 8.0.46", "ecosystem": "vendor"}, {"name": "Apache Tomcat 7", "fixed": ["7.0.82"], "affected": ">= 7.0.0, <= 7.0.81", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "file-upload", "java", "rce", "runtime", "self-hosted", "tomcat"] not_affected_if: ["default-config", "managed-hosting"] published_at: "2017-10-04T01:29:02+00:00" first_seen_at: "2026-10-23T19:11:52+00:00" updated_at: "2026-10-23T21:57:35+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12617", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-12617", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:25:53+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617", "first_seen_at": "2026-10-23T21:57:35+00:00"}] --- # Apache Tomcat: Apache Tomcat Remote Code Execution Vulnerability Tomcat's Default servlet (or WebDAV servlet) can be made to accept a crafted HTTP PUT that uploads a JSP, which the attacker then requests to run code as the Tomcat process. It only works when the servlet is configured with readonly=false and untrusted users can send PUT. A default install is not affected. Exploit code is public and the CVE is in CISA KEV. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Apache Tomcat affected ? fixed ? - vendor:Apache Tomcat 9 affected >= 9.0.0.M1, <= 9.0.0 fixed 9.0.1 - vendor:Apache Tomcat 8.5 affected >= 8.5.0, <= 8.5.22 fixed 8.5.23 - vendor:Apache Tomcat 8.0 affected >= 8.0.0.RC1, <= 8.0.46 fixed 8.0.47 - vendor:Apache Tomcat 7 affected >= 7.0.0, <= 7.0.81 fixed 7.0.82 ## How to check 1. Find the version: run version.sh (or catalina.sh version) and look for 9.0.0.M1-9.0.0, 8.5.0-8.5.22, 8.0.0.RC1-8.0.46 or 7.0.0-7.0.81. 2. Check exposure: in conf/web.xml and each webapp's WEB-INF/web.xml, look at the Default servlet (and any WebDAV servlet) for an init-param readonly set to false. If readonly is absent or true, you are not exposed. 3. Also check whether a reverse proxy or security constraint already blocks PUT/DELETE/MOVE/COPY from untrusted users. ## Fix Upgrade to Tomcat 9.0.1 or later, 8.5.23 or later, 8.0.47 or later, or 7.0.82 or later. Note that 7.0.x, 8.0.x and 8.5.x are now end of life, so move to a supported 9.0.x or later. Until then, set readonly to true on the Default and WebDAV servlets, or block HTTP methods that modify resources for untrusted users. ## Timeline - 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12617 - 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-12617 - 2026-10-23T21:25:53+00:00 analyst — Read Apache's advisory (lists.apache.org) and the Tomcat 7/8/9 security pages. Affected and fixed versions confirmed; only exposed when the Default servlet has readonly=false, so default installs are not affected. Public PoCs: Exploit-DB 42966 and Metasploit. KEV-listed and exploited. - 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-12617 ## Documents - [advisory] [SECURITY] CVE-2017-12617 Apache Tomcat RCE via JSP upload https://lists.apache.org/thread/bgsk95kmrdphzo9f32zvnz4vkqvwor3h - [fix] Apache Tomcat 9 security page https://tomcat.apache.org/security-9.html - [mitigation] Mark Thomas: CVE-2017-12617 investigation updates and mitigations https://www.mail-archive.com/users@tomcat.apache.org/msg127177.html - [poc] Exploit-DB 42966 Tomcat JSP upload bypass https://www.exploit-db.com/exploits/42966 - [poc] Metasploit tomcat_jsp_upload_bypass https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/multi/http/tomcat_jsp_upload_bypass.md ## From the sources When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_